Distributed learning aggregation method, storage medium and program product applied to attack scenarios

Abstract

The present invention relates to a distributed learning aggregation method, storage medium and program product applied in attack scenarios. The method comprises: constructing a heterogeneous distributed learning system including n nodes and a single parameter server; the parameter server obtains the gradient of each node; based on the received gradient of each node, the parameter server obtains the norm and direction of the gradient of each node; based on the norm and direction of the gradient of each node, the parameter server calculates the retention probability of each gradient, and performs probability screening to determine the retained gradient; according to the gradient screening result, the parameter server obtains the average value of each retained gradient, performs iterative optimization of global model parameters according to the average value of each retained gradient, and uses the finally optimized global model parameters to perform performance evaluation on the heterogeneous distributed learning system. The present invention combines the norm of the gradient with the direction information, and achieves the goal of maintaining Byzantine robustness in a heterogeneous distributed machine learning environment through probability screening.

Description

Technical Field

[0001] The present invention relates to the technical field of distributed machine learning, and in particular to a distributed learning aggregation method, storage medium and program product applied in an attack scenario. Background Art

[0002] With the advent of the big data era, distributed machine learning has become one of the important means to solve the challenge of large-scale data. In distributed learning, multiple nodes participate in model training together. Each node holds part of the training data and regularly reports local model updates to the central server. The server is responsible for aggregating the updates of all nodes to form a new global model. This distributed architecture can effectively utilize the computing resources of multiple nodes and speed up model training. However, data in practical applications usually presents heterogeneous distribution, that is, there are significant differences in the data distribution owned by each node. In heterogeneous distributed machine learning, achieving Byzantine robustness is a major challenge that needs to be solved urgently. In heterogeneous distributed machine learning, there is a threat of Byzantine attacks, that is, some Byzantine nodes upload incorrect model updates, which interfere with the convergence of the global model. Byzantine robustness refers to the accuracy and stability of global model training when there are Byzantine nodes in the system. Therefore, designing an effective aggregation method to resist Byzantine attacks and achieve Byzantine robustness is an important research direction in heterogeneous distributed machine learning.

[0003] In order to solve the Byzantine robustness problem in distributed machine learning, existing studies have proposed a variety of aggregation methods, but they still have certain limitations. Algorithms based on norm screening, such as Krum and Coordinate-wise Median, aim to eliminate potential malicious updates by calculating the norm of the gradient uploaded by each node and filtering out gradient updates with abnormal norms. Although such algorithms are simple to calculate and easy to implement, they only consider the gradient norm information and ignore the direction information, so they cannot effectively filter malicious gradients with abnormal directions but normal norms. On the other hand, algorithms based on direction screening, such as TDFL, use the gradient direction to detect abnormal points. However, such algorithms have poor filtering capabilities for malicious gradients with abnormal norms but normal directions. In addition, existing aggregation methods based on gradient norms or direction screening perform poorly in heterogeneous distributed learning and are difficult to cope with Byzantine attacks in heterogeneous environments. Therefore, in heterogeneous distributed machine learning, designing a simple and efficient Byzantine robust aggregation algorithm that can efficiently integrate norm and direction information is still a key problem to be solved.

[0004] In the prior art, Chinese patent document CN118250036A discloses an industrial Internet attack detection method based on distributed temporal graph learning. This solution uses traditional distributed learning methods to process high-dimensional temporal data, which has problems such as large communication overhead and low model accuracy, and it is difficult to fully utilize the potential correlation information between data of different dimensions. Chinese patent document CN117575037A discloses a distributed learning method, electronic device and storage medium that resists Byzantine attacks. This solution is difficult to deal with Byzantine attacks in heterogeneous environments, and has high processing complexity, and cannot meet the requirements of highly reliable distributed learning applications.

[0005] Therefore, in order to achieve Byzantine robustness in a heterogeneous data distribution environment, it is necessary to implement a distributed learning aggregation method, storage medium and program product for use in attack scenarios. Summary of the invention

[0006] In order to address the deficiencies in the prior art, the present invention proposes a distributed learning aggregation method, storage medium and program product applied in an attack scenario.

[0007] To achieve the above object, the present invention adopts the following technical solutions:

[0008] In a first aspect of the present invention, a distributed learning aggregation method applied in an attack scenario is disclosed, the method comprising the following steps:

[0009] S1. Construct a heterogeneous distributed learning system including n nodes and a single parameter server, wherein the nodes are divided into benign nodes and Byzantine nodes; among the n nodes, there are G benign nodes and B Byzantine nodes, n=G+B.

[0010] S2. The parameter server obtains the gradient of each node. Among them, the benign node uses the stochastic gradient descent algorithm to calculate the random gradient and sends it to the parameter server, and the Byzantine node sends the malicious gradient to the parameter server.

[0011] S3. Based on the received gradients of each node, the parameter server obtains the norm and direction of the gradients of each node.

[0012] S4. Based on the norm and direction of the gradient of each node, the parameter server calculates the retention probability of each gradient and performs probability screening to determine the retained gradient.

[0013] S5. According to the gradient screening results, the parameter server obtains the average value of each retained gradient, and iteratively optimizes the global model parameters according to the average value of each retained gradient, and uses the final optimized global model parameters to evaluate the performance of the heterogeneous distributed learning system.

[0014] Preferably, in step S1, a method of minimizing the loss function is used to establish a heterogeneous distributed learning system, and the optimization goal is:

[0015]

[0016] In formula (1), x * represents the parameter that minimizes the expected value of the average loss function of all benign nodes; f(x) represents the expected value of the average loss function of all benign nodes; G represents the number of benign nodes; f i Indicates that the working node i has its data distribution ξ i The loss function F defined above i The expected value of F i (x;ξ i ) represents the node i with respect to the data distribution ξ i and the loss function of the model parameters x; ξ i Represents the data distribution of node i, and the data distribution between nodes is heterogeneous.

[0017] Preferably, in step S2, the parameter server obtains the gradient of each node, wherein the benign node uses the stochastic gradient descent algorithm to calculate the stochastic gradient and sends it to the parameter server, and the Byzantine node sends the malicious gradient to the parameter server, including:

[0018] S21. If node i is a benign node, node i receives the current global model parameter x from the parameter server. t , from its data distribution ξ i Extract data samples from And use formula (2) to calculate the current global model parameter x t The gradient of the local loss function under , and the local stochastic gradient of node i is obtained:

[0019]

[0020] In formula (2), Represents the local stochastic gradient when node i is a benign node; Indicates that node i is a benign node in the current global model parameter x t Next, use your own data sample And the local loss function F i Compute the stochastic gradient.

[0021] S22. If node i is a Byzantine node, node i sends a malicious gradient to the parameter server to attack the parameter server.

[0022] S23. Use formula (3) to obtain the gradient sent by each node to the parameter server:

[0023]

[0024] In formula (3), represents the gradient sent by node i to the parameter server at the tth iteration of the heterogeneous distributed learning system; when node i is a benign node, the gradient sent by node i to the parameter server Equal to node i according to its own data sample And the local loss function F i The calculated stochastic gradient When node i is a Byzantine node, node i sends arbitrary malicious gradients* to the parameter server to destroy system performance.

[0025] Preferably, according to the present invention, in step S3, based on the received gradients of each node, the parameter server obtains the norm and direction of the gradients of each node, including:

[0026] S31. Based on the received gradients of each node, the parameter server calculates the average value of all gradients using formula (4) to obtain the average gradient:

[0027]

[0028] In formula (4), represents the average value of all gradients, i.e., the average gradient; n represents the number of nodes; Represents the random gradient sent by node i to the parameter server at the tth iteration.

[0029] S32, the parameter server calculates the norm of each gradient, and uses formula (5) to calculate the average value of all gradient norms to determine the size distribution of each node gradient:

[0030]

[0031] In formula (5), represents the average value of all gradient norms; n represents the number of nodes; Represents the gradient sent by node i to the parameter server at the tth iteration.

[0032] S33, the parameter server calculates the cosine similarity between the gradient of each node and the average gradient using formula (6) to determine the direction distribution of the gradient of each node:

[0033]

[0034] In formula (6), cosθ i represents the cosine similarity between the gradient of node i and the average gradient; represents the gradient sent by node i to the parameter server at the tth iteration; represents the average of all gradients.

[0035] Preferably, in step S4, based on the norm and direction of each node gradient, the parameter server calculates the retention probability of each gradient, and performs probability screening to determine the retained gradient, including:

[0036] S41. Based on the norm and direction of each node gradient, the parameter server calculates the retention probability for each gradient using formula (7):

[0037]

[0038] In formula (7), p i represents the retention probability of the gradient of node i, and the independent variable of this function is a and b are two hyperparameters used to control the influence of direction information and norm information on the retention probability; exp represents the exponential function; is the Sigmoid function, which converts the independent variable Mapped to a probability value in the interval (0, 1); cosθ i represents the cosine similarity between the gradient of node i and the average gradient; Represents the gradient sent by node i to the parameter server at the tth iteration.

[0039] S42. According to the retention probability of each gradient, the parameter server aggregates each node, determines the node type, and screens the gradient to obtain the retained gradient.

[0040] Preferably, in step S5, according to the gradient screening result, the parameter server obtains the average value of each retained gradient, and performs iterative optimization of the global model parameters according to the average value of each retained gradient, and uses the finally optimized global model parameters to perform performance evaluation on the heterogeneous distributed learning system, including:

[0041] S51. Based on the gradient screening results, the parameter server uses formula (8) to average the retained gradients after probability screening to obtain the average gradient v t :

[0042]

[0043] In formula (8), v t represents the average value of all retained gradients; m represents the number of gradients actually retained after probability screening; Represents the gradient sent by node i to the parameter server at the tth iteration.

[0044] S52, based on the average gradient v t, the parameter server uses formula (9) to iteratively optimize the global model parameters until the stopping condition is met:

[0045] x t+1 =x t -γ·v t (9);

[0046] In formula (9), x t+1 represents the global model parameters at the t+1th iteration; x t represents the global model parameters at the tth iteration; γ represents the learning rate; v t represents the average gradient.

[0047] S53. Use the final optimized global model parameters to evaluate the performance of the heterogeneous distributed learning system.

[0048] In a second aspect of the present invention, a machine-readable storage medium is disclosed, on which executable instructions are stored, and when the instructions are executed, the machine executes the distributed learning aggregation method applied to the attack scenario as described above.

[0049] In a third aspect of the present invention, a program product is disclosed, comprising: a program product for implementing the distributed learning aggregation method applied to an attack scenario, the computer program product being tangibly stored on a non-volatile computer-readable medium and comprising machine executable instructions, the machine executable instructions being used to execute the above method.

[0050] Compared with the prior art, the advantages of the present invention are:

[0051] (1) The distributed learning aggregation method proposed in the present invention has significant advantages in Byzantine attack scenarios. In attack scenarios, malicious nodes launch Byzantine attacks and upload malicious gradients to interfere with the training of global model parameters. For attack scenarios, the present invention cleverly combines the norm and direction information of the gradient for probabilistic screening, forming a multi-dimensional gradient anomaly detection mechanism that can effectively identify and filter out malicious gradients. Compared with existing single screening methods, the present invention can comprehensively identify various types of malicious gradients, greatly improving the robustness of distributed learning systems in attack scenarios.

[0052] (2) The present invention can effectively reduce computational complexity, dynamically select honest gradient clients using three hyperparameters, and balance security and model accuracy. Aiming at the Byzantine attack problem faced by heterogeneous distributed machine learning, the present invention proposes an innovative aggregation method that can achieve Byzantine robustness in a heterogeneous data distribution environment by integrating gradient norm and direction information and using probabilistic screening, effectively improving the robustness and reliability of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 It is a process flow chart of the distributed learning aggregation method applied to the attack scenario in the present invention;

[0054] Figure 2 It is a test accuracy curve of different methods in a non-attack scenario, where the horizontal axis represents the scaled representation of the number of iterations, each unit represents 60 iterations, and the vertical axis represents the test accuracy;

[0055] Figure 3 It is a curve chart of the test accuracy of different methods in the Mimic attack scenario, where the horizontal axis represents the scaled representation of the number of iterations, each unit represents 60 iterations, and the vertical axis represents the test accuracy.

[0056] Figure 4 It is a curve chart of the test accuracy of different methods in the Bit Flipping attack scenario, where the horizontal axis represents the scaled representation of the number of iterations, each unit represents 60 iterations, and the vertical axis represents the test accuracy.

[0057] Figure 5 It is a curve chart of the test accuracy of different methods under the IPM attack scenario, where the horizontal axis represents the scaled representation of the number of iterations, each unit represents 60 iterations, and the vertical axis represents the test accuracy. DETAILED DESCRIPTION

[0058] The present disclosure is further described below with reference to the accompanying drawings and embodiments:

[0059] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

[0060] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0061] In the absence of conflict, the embodiments in the present disclosure and the features in the embodiments may be combined with each other.

[0062] Example 1

[0063] The present embodiment relates to a distributed learning aggregation method applied in an attack scenario, the method comprising: constructing a heterogeneous distributed learning system, and the parameter server obtains the gradient of each node. The benign node uses the stochastic gradient descent algorithm to train the local model, and uploads the calculated gradient to the parameter server. The parameter server calculates the norm of the gradient uploaded by each node, and calculates the average value of the gradient uploaded by all nodes and the average value of all gradient norms. The cosine similarity between each gradient and the average gradient is calculated. Based on the cosine similarity and norm of each gradient, the probability of the gradient being retained is calculated. In each iteration, a random threshold between 0 and 1 is generated and compared with the retention probability of each gradient. If the retention probability is greater than the random threshold, the gradient is retained. The probability is combined with the norm information and direction information of the gradient to effectively screen out useful gradients and filter out potential malicious updates. All retained gradients are averaged to obtain the final global gradient, and the aggregated global gradient is used for parameter update. The present invention combines the norm of the gradient with the direction information, and achieves the goal of maintaining Byzantine robustness in a heterogeneous distributed machine learning environment through probabilistic screening.

[0064] like Figure 1 A distributed learning aggregation method applied to an attack scenario is shown, the method comprising the following steps:

[0065] S1. Construct a heterogeneous distributed learning system including n nodes and a single parameter server, wherein the nodes are divided into benign nodes and Byzantine nodes.

[0066] Among the n nodes, there are G benign nodes and B Byzantine nodes, n = G + B. The Byzantine nodes send false information to the parameter server to disrupt the normal operation of the system, and their identities are unknown to the parameter server.

[0067] In step S1, a heterogeneous distributed learning system is established by minimizing the loss function, and its optimization goal is:

[0068]

[0069] In formula (1), x * represents the parameter that minimizes the expected value of the average loss function of all benign nodes; f(x) represents the expected value of the average loss function of all benign nodes; G represents the number of benign nodes; f i Indicates that the working node i has its data distribution ξ i The loss function F defined above i The expected value of F i (x;ξ i ) represents the node i with respect to the data distribution ξ i and the loss function of the model parameters x; ξ iRepresents the data distribution of node i, and the data distribution between nodes is heterogeneous.

[0070] S2. The parameter server obtains the gradient of each node. Among them, the benign node uses the stochastic gradient descent algorithm to calculate the random gradient and sends it to the parameter server, and the Byzantine node sends the malicious gradient to the parameter server.

[0071] The method of the present invention will iterate multiple times until the objective function or the maximum number of iterations set is reached. The following description takes the tth iteration of the heterogeneous distributed learning system as an example.

[0072] S21. If node i is a benign node, node i receives the current global model parameter x from the parameter server. t , from its data distribution ξ i Extract data samples from And use formula (2) to calculate the current global model parameter x t The gradient of the local loss function under , and the local stochastic gradient of node i is obtained:

[0073]

[0074] In formula (2), Represents the local stochastic gradient when node i is a benign node; Indicates that node i is a benign node in the current global model parameter x t Next, use your own data sample And the local loss function F i Compute the stochastic gradient.

[0075] S22. If node i is a Byzantine node, node i sends a malicious gradient to the parameter server to attack the parameter server.

[0076] S23. Use formula (3) to obtain the gradient sent by each node to the parameter server:

[0077]

[0078] In formula (3), represents the gradient sent by node i to the parameter server at the tth iteration of the heterogeneous distributed learning system; when node i is a benign node, the gradient sent by node i to the parameter server Equal to node i according to its own data sample And the local loss function F i The calculated stochastic gradient When node i is a Byzantine node, node i sends arbitrary malicious gradients* to the parameter server to destroy system performance.

[0079] Benign nodes send random gradients to the parameter server, while malicious nodes send malicious gradients to the parameter server. Benign nodes send their local random gradients to the parameter server. Uploaded to the parameter server, the Byzantine nodes collude with each other and send arbitrary malicious gradients* to the parameter server, which causes deviations in the optimization process, further affecting the accuracy and convergence of the global model parameters, resulting in a serious degradation of the performance of the distributed learning system.

[0080] S3. Based on the received gradients of each node, the parameter server obtains the norm and direction of the gradients of each node.

[0081] S31. Based on the received gradients of each node, the parameter server calculates the average value of all gradients using formula (4) to obtain the average gradient:

[0082]

[0083] In formula (4), represents the average value of all gradients, i.e., the average gradient; n represents the number of nodes; Represents the random gradient sent by node i to the parameter server at the tth iteration.

[0084] The purpose of step S31 is to obtain an overall trend to provide a basis for subsequent gradient evaluation and malicious gradient screening.

[0085] S32, the parameter server calculates the norm of each gradient, and uses formula (5) to calculate the average value of all gradient norms to determine the size distribution of each node gradient:

[0086]

[0087] In formula (5), represents the average value of all gradient norms; n represents the number of nodes; Represents the gradient sent by node i to the parameter server at the tth iteration.

[0088] Step S32 helps evaluate the size distribution of gradients and identify possible malicious gradients. In step S32, the norm of each gradient obtained by the parameter server in step S2 is first calculated, and then the average of all norms is taken. In other words, the norm of the random gradient sent by the benign node and the malicious gradient sent by the Byzantine node is calculated first. Then the norm of all nodes Take the average.

[0089] S33, the parameter server calculates the cosine similarity between the gradient of each node and the average gradient using formula (6) to determine the direction distribution of the gradient of each node:

[0090]

[0091] In formula (6), cosθ i represents the cosine similarity between the gradient of node i and the average gradient; represents the gradient sent by node i to the parameter server at the tth iteration; Represents the average value of all gradients. Taking node i as an example, node i represents any node among n nodes, and the cosine similarity of n nodes must be calculated.

[0092] The cosine similarity of all nodes is calculated in step S33 to evaluate the consistency of each gradient with the overall trend, thereby identifying malicious gradients with abnormal directions.

[0093] Through steps S31 to S33, the parameter server can evaluate the direction and magnitude information of each gradient, providing a basis for the subsequent probability screening process.

[0094] S4. Based on the norm and direction of each node gradient, the parameter server uses formula (7) to calculate the retention probability of each gradient, and performs probability screening to determine the retained gradient. The probability screening process integrates the gradient norm and direction information.

[0095] S41. Based on the norm and direction of each node gradient, the parameter server calculates the retention probability for each gradient using formula (7):

[0096]

[0097] In formula (7), p i represents the retention probability of the gradient of node i, and the independent variable of this function is a and b are two hyperparameters used to control the influence of direction information and norm information on the retention probability; exp represents the exponential function; is the Sigmoid function, which converts the independent variable Mapped to a probability value in the interval (0, 1); cosθ i represents the cosine similarity between the gradient of node i and the average gradient; Represents the gradient sent by node i to the parameter server at the tth iteration.

[0098] From formula (7), we can see that the cosine value of the angle cosθ i The larger the gradient, the The more consistent with the average gradient direction, the more likely the gradient uploaded by node i is a normal gradient, and node i is more likely to be a benign node. Therefore, the parameter server should use a greater probability p i Keep the gradient uploaded by node i to incorporate it into the aggregation of global model parameters.

[0099] From formula (7), we can see that the gradient norm The larger the gradient, the The more abnormal the amplitude, the greater the gradient The more likely it is that the gradient is abnormal, the more likely node i is a Byzantine node. Therefore, the parameter server should use a smaller probability p i Keep the gradient uploaded by node i This is to prevent possible malicious gradients from being included in the aggregation of global model parameters, thereby affecting the performance of the distributed learning system. The hyperparameter a controls the steepness of the probability function. The larger a is, the smaller p i The steeper the transition between 0 and 1. b is a hyperparameter used to balance the impact of norm and direction on the retention probability p i degree of impact.

[0100] S42. According to the retention probability of each gradient, the parameter server aggregates each node, determines the node type, and screens the gradient to obtain the retained gradient.

[0101] At each iteration, the system automatically generates a random threshold k between 0 and 1. The retention probability p of each gradient i Compare with random threshold k. If the retention probability p i If the probability of retention pi is greater than the random threshold k, the gradient is retained. Using a random threshold k instead of a fixed value can introduce a certain amount of randomness in each iteration. The random threshold k is regenerated in each iteration, which allows the algorithm to dynamically adapt to changes in gradient characteristics during training. By comparing the retention probability pi and the random threshold k, the algorithm can strike a balance between retaining useful gradients and filtering abnormal gradients. This balance is dynamic and can be automatically adjusted according to the current situation.

[0102] S5. According to the gradient screening results, the parameter server obtains the average value of each retained gradient, and iteratively optimizes the global model parameters according to the average value of each retained gradient, and uses the final optimized global model parameters to evaluate the performance of the heterogeneous distributed learning system.

[0103] S51. Based on the gradient screening results, the parameter server uses formula (8) to average the retained gradients after probability screening to obtain the average gradient v t :

[0104]

[0105] In formula (8), v t represents the average value of all retained gradients; m represents the number of gradients actually retained after probability screening; Indicates the gradient sent by node i to the parameter server at the tth iteration. i represents any value between 1 and n. A node i is randomly selected from n nodes for the sake of example.

[0106] Through multiple rounds of iterations, most of the malicious gradients will be due to p i The smaller the gradient, the smaller the gradient will be gradually eliminated, while most of the normal gradient will be eliminated due to p i Finally, in the aggregation stage, since most of the malicious gradients have been identified and screened out, the average value of the remaining gradients will be dominated by normal gradients, thereby weakening the influence of malicious nodes and improving the robustness of heterogeneous distributed learning systems under attack scenarios.

[0107] S52, based on the average gradient v t , the parameter server uses formula (9) to iteratively optimize the global model parameters until the stopping condition is met:

[0108] x t+1 =x t -γ·v t (9);

[0109] In formula (9), x t+1 represents the global model parameters at the t+1th iteration; x t represents the global model parameters at the tth iteration; γ represents the learning rate; v t represents the average gradient.

[0110] Step S52 is to iteratively optimize the global model parameters of the heterogeneous distributed learning system until the objective function shown in formula (1) is satisfied or the set maximum number of iterations is reached.

[0111] S53. Use the final optimized global model parameters to evaluate the performance of the heterogeneous distributed learning system.

[0112] In the heterogeneous distributed learning scenario with Byzantine attacks, Byzantine nodes will upload wrong gradients in an attempt to interfere with the learning of the global model. The present invention can still train a correct global model for classification tasks in the presence of Byzantine nodes. The present invention cleverly combines the norm of the gradient with the direction information, and through probabilistic screening, achieves the goal of maintaining robustness in heterogeneous distributed machine learning with Byzantine attacks.

[0113] In order to verify the effect of the distributed learning aggregation method applied to the attack scenario described in the present invention, the method described in the present invention was evaluated by training the MLP model on the heterogeneous MNIST dataset. MLP, or Multi-Layer Perceptron, is a feedforward artificial neural network model.

[0114] The construction process of the heterogeneous MNIST dataset is as follows:

[0115] The MNIST dataset is a classic dataset for handwritten digit recognition, containing 60,000 training samples and 10,000 test samples. Each sample is a 28x28 pixel grayscale image, and each image corresponds to a digital label between 0 and 9. First, sort the MNIST dataset according to the sample labels. Divide the sorted dataset evenly into several blocks of equal size, and the number of blocks is equal to the number of benign nodes participating in the training. The entire dataset is divided into multiple subsets, each of which is distributed on a node. The data subsets owned by different nodes differ in quantity, category, etc., and each node only accesses its own data distribution. Each benign node obtains one of the blocks as its local dataset. Inside each node, the obtained local dataset is randomly shuffled.

[0116] The loss function uses negative log-likelihood loss to evaluate the training effect of global model parameters. The definition of negative log-likelihood loss function is shown in formula (10):

[0117] f(x)=NLL(x,y)=-logp(y|x) (10);

[0119] Among them, x represents the input data, y represents the true label, and p(y|x) represents the probability that the model predicts the input data x as label y.

[0120] The method of the present invention (denoted as DNPS in the experiment) is compared with CM (coordinate median), Krum, Trimmed-mean, RFA (robust federated average), and NBS (norm-based screening) methods, and four attack scenarios are considered: no attack, Mimic attack, Bit Flipping attack, and IPM attack. The experimental results are shown in Figure 2. Figure 2-Figure 5 shown.

[0121] like Figure 2 The test accuracy curves of different methods in the non-attack scenario are shown in the figure, where the horizontal axis is a scaled representation of the number of iterations, each unit represents 60 iterations, and the vertical axis represents the test accuracy. Figure 2 It can be seen that in the non-attack scenario, the method described in the present invention achieves the highest test accuracy, which is better than other methods. The test accuracy in the experiment is the accuracy statistics of the classification task.

[0122] like Figure 3The test accuracy curve of different methods under the Mimic attack scenario shown in Figure 1 is a graph where the horizontal axis is a scaled representation of the number of iterations, each unit represents 60 iterations, and the vertical axis represents the test accuracy. All Byzantine nodes select a benign node to imitate and copy its output. Figure 3 It can be seen that in the Mimic attack scenario, the method described in the present invention achieves the highest test accuracy, which is better than other methods.

[0123] like Figure 4 The graph of the test accuracy of different methods in the Bit Flipping attack scenario is shown in the figure, where the horizontal axis is a scaled representation of the number of iterations, each unit represents 60 iterations, and the vertical axis represents the test accuracy. In the Bit Flipping attack scenario, the Byzantine node calculates its own stochastic gradient according to the current global model parameters. However, it does not send this random gradient to the parameter server, but instead takes the negative value of this gradient to construct a malicious gradient, and then sends the malicious gradient Sent to the parameter server. Figure 4 It can be seen that in the Bit Flipping attack scenario, the method described in the present invention achieves the highest test accuracy, which is better than other methods.

[0124] like Figure 5 The test accuracy curve of different methods under the IPM attack scenario shown in the figure, where the horizontal axis is a scaled representation of the number of iterations, each unit represents 60 iterations, and the vertical axis represents the test accuracy. In the IPM attack scenario, the Byzantine node first calculates the average of the gradients of all benign nodes, then multiplies this average gradient by a negative coefficient -∈, and finally sends this manipulated gradient as a malicious gradient to the parameter server. Figure 5 It can be seen that in the IPM attack scenario, the method described in the present invention achieves the highest test accuracy, which is better than other methods.

[0125] Under the above four Byzantine attacks, the method described in the present invention demonstrates excellent defense capabilities, can effectively resist malicious attacks from Byzantine nodes, and ensure the normal performance of the distributed learning system. Compared with other existing methods, the present invention has significant advantages in test accuracy and improves the robustness of the distributed learning system under attack scenarios.

[0126] Example 2

[0127] This embodiment provides a machine-readable storage medium, on which executable instructions are stored. When the instructions are executed, the machine executes the distributed learning aggregation method applied to the attack scenario described in Example 1.

[0128] Specifically, a system or device equipped with a readable storage medium can be provided, on which software program codes that implement the functions of any of the above-mentioned embodiments are stored, and a computer or processor of the system or device can read and execute instructions stored in the readable storage medium.

[0129] In this case, the program code itself read from the machine-readable medium can realize the function of any one of the above embodiments, and thus the machine-readable code and the machine-readable storage medium storing the machine-readable code constitute part of this specification.

[0130] Examples of readable storage media include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD-RW), magnetic tapes, non-volatile memory cards, and ROMs. Alternatively, the program code may be downloaded from a server computer or a cloud via a communication network.

[0131] Example 3

[0132] This embodiment also provides a program product, including: a program product that implements the method described in Example 1, the computer program product is tangibly stored on a non-volatile computer-readable medium and includes machine executable instructions, and the machine executable instructions are used to execute the above method.

[0133] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0134] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0135] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0136] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0137] The above-described embodiments are merely descriptions of preferred implementations of the present invention and are not intended to limit the scope of the present invention. Without departing from the design spirit of the present invention, various modifications and improvements made to the technical solutions of the present invention by ordinary technicians in this field should all fall within the scope of protection determined by the claims of the present invention.

Claims

1. A distributed learning aggregation method applied in an attack scenario, characterized in that: The method comprises the following steps: S1. Construct a heterogeneous distributed learning system including n nodes and a single parameter server, wherein the nodes are divided into benign nodes and Byzantine nodes; among the n nodes, there are G benign nodes and B Byzantine nodes, n=G+B; S2. The parameter server obtains the gradient of each node. Among them, the benign node uses the stochastic gradient descent algorithm to calculate the stochastic gradient and sends it to the parameter server, and the Byzantine node sends the malicious gradient to the parameter server; S3. Based on the received gradients of each node, the parameter server obtains the norm and direction of the gradients of each node; S4. Based on the norm and direction of each node gradient, the parameter server calculates the retention probability of each gradient, and performs probability screening to determine the retained gradient. The calculation formula is: In formula (7), p i represents the retention probability of the gradient of node i; cosθ i represents the cosine similarity between the gradient of node i and the average gradient; represents the gradient sent by node i to the parameter server at the tth iteration. a and b are two hyperparameters used to control the influence of direction information and norm information on the retention probability. S5. According to the gradient screening result, the parameter server obtains the average value of each retained gradient, and performs iterative optimization of the global model parameters according to the average value of each retained gradient, wherein the global model is an MLP model to realize the classification of image data.

2. The distributed learning aggregation method applied to attack scenarios according to claim 1 is characterized in that: In step S1, a heterogeneous distributed learning system is established by minimizing the loss function, and its optimization goal is: In formula (1), x * represents the parameter that minimizes the expected value of the average loss function of all benign nodes; f(x) represents the expected value of the average loss function of all benign nodes; G represents the number of benign nodes; f i Indicates that the working node i has its data distribution ξ i The loss function F defined above i The expected value of F i (x;ξ i ) represents the node i with respect to the data distribution ξ i and the loss function of the model parameters x; ξ i Represents the data distribution of node i, and the data distribution between nodes is heterogeneous.

3. The distributed learning aggregation method applied to attack scenarios according to claim 1 is characterized in that: In step S2, the parameter server obtains the gradient of each node, wherein the benign node uses the stochastic gradient descent algorithm to calculate the stochastic gradient and sends it to the parameter server, and the Byzantine node sends the malicious gradient to the parameter server, including: S21. If node i is a benign node, node i receives the current global model parameter x from the parameter server. t , from its data distribution ξ i Extract data samples from And use formula (2) to calculate the current global model parameter x t The gradient of the local loss function under , and the local stochastic gradient of node i is obtained: In formula (2), Represents the local stochastic gradient when node i is a benign node; Indicates that node i is a benign node in the current global model parameter x t Next, use your own data sample And the local loss function F i Computed stochastic gradients; S22. If node i is a Byzantine node, node i sends a malicious gradient to the parameter server to attack the parameter server. S23. Use formula (3) to obtain the gradient sent by each node to the parameter server: In formula (3), represents the gradient sent by node i to the parameter server at the tth iteration of the heterogeneous distributed learning system; when node i is a benign node, the gradient sent by node i to the parameter server Equal to node i according to its own data sample And the local loss function F i The calculated stochastic gradient When node i is a Byzantine node, node i sends arbitrary malicious gradients* to the parameter server to destroy system performance.

4. The distributed learning aggregation method applied to attack scenarios according to claim 1 is characterized in that: In step S3, based on the received gradients of each node, the parameter server obtains the norm and direction of the gradients of each node, including: S31. Based on the received gradients of each node, the parameter server calculates the average value of all gradients using formula (4) to obtain the average gradient: In formula (4), represents the average value of all gradients, i.e., the average gradient; n represents the number of nodes; represents the random gradient sent by node i to the parameter server at the tth iteration; S32, the parameter server calculates the norm of each gradient, and uses formula (5) to calculate the average value of all gradient norms to determine the size distribution of each node gradient: In formula (5), represents the average value of all gradient norms; n represents the number of nodes; represents the gradient sent by node i to the parameter server at the tth iteration; S33, the parameter server calculates the cosine similarity between the gradient of each node and the average gradient using formula (6) to determine the direction distribution of the gradient of each node: In formula (6), cosθ i represents the cosine similarity between the gradient of node i and the average gradient; represents the gradient sent by node i to the parameter server at the tth iteration; represents the average of all gradients.

5. The distributed learning aggregation method applied to attack scenarios according to claim 1 is characterized in that: In step S5, according to the gradient screening result, the parameter server obtains the average value of each retained gradient, and performs iterative optimization of the global model parameters according to the average value of each retained gradient, and uses the finally optimized global model parameters to perform performance evaluation on the heterogeneous distributed learning system, including: S51. Based on the gradient screening results, the parameter server uses formula (8) to average the retained gradients after probability screening to obtain the average gradient v t : In formula (8), v t represents the average value of all retained gradients; m represents the number of gradients actually retained after probability screening; represents the gradient sent by node i to the parameter server at the tth iteration; S52, based on the average gradient v t , the parameter server uses formula (9) to iteratively optimize the global model parameters until the stopping condition is met: x t+1 =x t -γ·v t (9); In formula (9), x t+1 represents the global model parameters at the t+1th iteration; x t represents the global model parameters at the tth iteration; γ represents the learning rate; v t represents the average gradient; S53. Use the final optimized global model parameters to evaluate the performance of the heterogeneous distributed learning system.

6. A machine-readable storage medium, characterized in that: The machine-readable storage medium stores executable instructions, which, when executed, enable the machine to execute the distributed learning aggregation method applied to an attack scenario as described in any one of claims 1 to 5.

7. A program product, characterized in that include: A program product for implementing the distributed learning aggregation method applied to an attack scenario as described in any one of claims 1 to 5, wherein the program product is tangibly stored on a non-transitory computer-readable medium and includes machine-executable instructions, and the machine-executable instructions are used to execute the above method.

Images